Skip to main content
A step-by-step walkthrough for silent deployment of the Origin macOS agent — configuration profile, install script, and end-to-end Tanium deployment flow.

​
Overview

Deploying the Origin agent on macOS requires two Tanium products working in sequence:
  • Tanium Device Management pushes the MDM configuration profile that pre-approves the system permission the agent needs. Without this profile, the agent will hit an interactive Full Disk Access dialog on first run and silent install will fail.
  • Tanium Deploy stages the provisioning JWT and executes the installer, but only on endpoints where the profile has successfully installed.
The two products are independent — Device Management uses Apple’s MDM/APNs channel, and Deploy uses the Tanium Client. Both must be in place on the endpoint before the agent install runs.

​
Prerequisites

Before starting, confirm the following:
  • Tanium Cloud admin access with permissions to configure Device Management (Shared Services → Device Management) and Deploy (Modules → Deploy)
  • A Tanium license that includes Tanium Enforce (required by Device Management)
  • An Apple Push Notification Service (APNs) certificate configured in Device Management — Shared Services → Device Management → Settings → Push Certificate
  • Target Macs enrolled in Tanium Device Management (see Step 1)
  • A valid Origin provisioning JWT — obtain from the Origin console under Endpoints → Connect
  • The Origin macOS installer (Origin.pkg) — download from the Origin console under Endpoints → Connect
  • The origin-privacy.mobileconfig configuration profile, downloadable below
Configuration profile download: origin-privacy.mobileconfig

​
Files

​
Identifiers

​
Deployment Order

The privacy configuration profile must reach Installed status on the endpoint before the Deploy package runs. The Deploy deployment is gated on this via a computer group (Step 5) — it will not run on a Mac until the profile is confirmed installed.

​
Step 1 — Enroll Macs in Device Management

Macs must be enrolled in Tanium Device Management before profiles can be pushed. Device Management enrollment also automatically installs the Tanium Client, which Deploy requires. If your Macs are purchased through Apple Business Manager (ABM) or Apple School Manager (ASM), configure automated device enrollment so Macs enroll into Tanium Device Management at setup time with no user interaction required.
  1. Go to Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Automated Enrollment
  2. Follow the prompts to link your ABM/ASM token and configure the enrollment experience

​
Manual enrollment (testing / pilot)

For individual Macs not in ABM, download and install the enrollment profile manually:
  1. Go to Shared Services → Device Management → Settings (GEAR icon, not the side menu) → Device Enrollment
  2. In the Manual Enrollment section, click Download and select the macOS enrollment file
  3. Copy the profile to the target Mac and install it
  4. On the Mac, open the profile in System Settings and confirm installation
Tanium Device Management manual enrollment Once enrolled, the Tanium Client installs automatically. Verify enrollment by checking that the Mac appears in Shared Services → Device Management with a recent check-in time. Alternatively, you can ask the question:
Tanium Interact enrollment question results

​
Step 2 — Prepare and Upload the Configuration Profile

The privacy profile is uploaded as a Custom Setting in Tanium Device Management. Device Management pushes it via the MDM/APNs channel — no Tanium Enforce payload editors are used.
Do not recreate this profile using Tanium Enforce’s built-in payload editors. The editors rewrite the XML and could break the code requirement in the PPPC profile. Upload the raw .mobileconfig file only.

​
Upload the profile

  1. Go to Shared Services → Device Management → Settings
  2. In the Custom Setting section, click +
  3. Name the setting Origin - Privacy — use this exact name. The computer group created in Step 5 matches against it in sensor output.
  4. In Choose a platform, select macOS
  5. In Upload your profile, drag and drop origin-privacy.mobileconfig
  6. Click Open, then Save
Tanium custom setting upload

​
Step 3 — Create the Collection

A Device Management collection targets the setting to the appropriate devices.
  1. Go to Shared Services → Device Management → Collections
  2. Click Add Collection
  3. Name the collection Origin Agent - Profiles
  4. Click Add for the Origin - Privacy setting and click Next
  5. Skip the Applications step and click Next
  6. Configure targeting — select the computer group containing your target Macs
  7. Click Preview Targeted Endpoints to verify scope, then Save
Allow a few minutes for the profile to push via MDM. Monitor progress on the collection’s Overview tab — the setting should reach Installed before proceeding to Step 5.

​
Step 4 — Verify the Profile on the Endpoint

Before building the Deploy package, confirm the profile is installed correctly on a test endpoint. Privacy profile installed:
Should return the Origin privacy profile. In Tanium Interact, confirm the sensor output looks correct — run this question against your test Mac:
You should see output like:

​
Step 5 — Create the Computer Group

The Deploy deployment is scoped to this computer group. A Mac joins the group only when the Origin privacy profile is confirmed installed — this is the gate that prevents the Deploy package from running on unprepared endpoints.
  1. Go to Administration → Computer Groups
  2. Click New Computer Group
  3. Name it Origin Profiles Installed
  4. Set the filter expression to:
  1. Click Preview to confirm your test Mac appears in the group
  2. Click Save
Tanium computer group filter How the regex works: The condition matches a row in the sensor output that begins with the profile name Origin - Privacy, followed by a pipe delimiter (with optional whitespace), followed by Installed. This ensures both the profile name and its status are confirmed together — a condition like contains "Installed" alone would match any profile that happens to be installed, not the specific one named.

​
Step 6 — Create the Deploy Package

A single Deploy software package with three sequential commands handles JWT staging, installation, and cleanup.

​
Package details

  1. Go to Modules → Deploy → Software → Software Packages
  2. Click Create Package
  3. Fill in the package details:

​
Package files

In the Package Files section, upload both files:
  • Origin.pkg
  • jwt.txt — a plain text file containing your provisioning JWT (just the token string, no newline)
jwt.txt is uploaded as a package file so Deploy distributes it to the endpoint before any commands run. The JWT never appears in the command body and is therefore not visible to admins browsing package details. Tanium Deploy package files

​
System requirements

  • Architecture: x64
  • Minimum OS: macOS 13.0

​
Install operation

Enable the Install operation and ensure Require Source Files is selected. Add three sequential Run Commands: Command 1 — Stage the JWT
This copies jwt.txt to the path the postinstall expects, with permissions set to read-only by owner (root/SYSTEM). Success code: 0. Command 2 — Install Origin
Success code: 0. Command 3 — Clean up the JWT
Success code: 0. If Command 1 or 2 fails, Deploy will not proceed to the next command. The cleanup in Command 3 also runs on success — if the installer itself fails and leaves the JWT file behind, note that the file has mode 400 (root read-only) so it is not readable by other processes. Tanium Deploy run commands

​
Installation requirements

This ensures the package only runs on Macs that do not already have Origin installed:

​
Install verification

This confirms Origin installed successfully: Tanium Deploy install verification

​
Save the package

Click Create Package and wait for Status to reach 100% before deploying.

​
Step 7 — Create the Deployment

  1. Go to Modules → Deploy → Deployments and click New Deployment
  2. Select Software Package and choose Origin Agent - Install (macOS)
  3. Select Install as the operation
  4. In Endpoints to Target, select the Origin Profiles Installed computer group
  5. Set Deployment Type to Ongoing — this ensures newly enrolled Macs automatically receive the agent once their profile reaches Installed status
  6. Configure a maintenance window if required by your change management policy
  7. Click Deploy
Tanium new deployment The ongoing deployment plus the dynamic computer group makes this fully zero-touch for new Macs going forward. A Mac enrolls in Device Management → the profile pushes via MDM → the profile reaches Installed → the Mac joins the Origin Profiles Installed group → Deploy fires automatically.

​
Step 8 — Verification

Run these checks on a target endpoint after the deployment completes.

​
Deploy job status

Open the deployment in Modules → Deploy → Deployments and confirm the endpoint shows Installed status. Tanium deployment status

​
Profile installed

Should return the Origin privacy profile.

​
Agent process running

Returns a PID when the agent is running.

​
JWT cleaned up

Expected: No such file or directory

​
Agent log

Confirms agent started cleanly and registration succeeded.

​
Origin console

In the Origin console, click Computers and search for the target hostname. A successfully registered endpoint will appear with a recent snapshot time and its detected AI agents populated. Origin console registered endpoint

​
Step 9 — Troubleshooting

​
Profile shows Failed or Pending in Device Management

Check the setting status on the collection’s Devices tab.
  • AllowedTeamIdentifiers conflict — the profile XML was modified or recreated using a payload editor. Re-upload the raw .mobileconfig from the deployment package.
  • Profile stuck Pending — trigger an MDM check-in from the device’s Endpoint Details page using Deploy Action → Refresh Device Data, or wait for the next scheduled check-in.

​
Mac not appearing in the Origin Profiles Installed computer group

Run the sensor question manually in Interact to confirm the output format matches the regex:
If the profile name in the output differs from Origin - Privacy, update the computer group regex to match the actual name.

​
JWT prompt appears during install (non-silent install)

The installer postinstall did not find the staged JWT. Check:
  1. Command 1 (install -m 400 jwt.txt /var/tmp/origin-provisioning-jwt) completed with exit code 0 — check the Deploy job log
  2. jwt.txt was uploaded to the package files and Require Source Files is enabled on the Install operation
  3. jwt.txt contains only the JWT string with no trailing newline or whitespace

​
Deploy package shows Not Applicable

The Installation Requirements rule (/Applications/Origin.app does not exist) is evaluating as not met — meaning Origin is already installed on the endpoint. Check the endpoint in the Origin console to confirm whether it is already registered.

​
Origin not appearing in Origin console after install

  • Confirm outbound HTTPS (port 443) from the endpoint to the Origin cloud backend is not blocked by a network proxy or firewall
  • Check the agent log: cat /Library/Origin/logs/agent.log.$(date -u +%Y-%m-%d)
  • Confirm the JWT in jwt.txt was valid and had not expired at install time

​
Step 10 — Maintenance

​
Updating the Origin agent

  1. Download the new Origin.pkg from the Origin console
  2. Edit the Origin Agent - Install (macOS) package in Deploy — replace Origin.pkg in Package Files and increment the version
  3. Update the Install Verification if the app version changes
  4. The ongoing deployment automatically pushes the update to enrolled endpoints

​
Rotating the provisioning JWT

  1. Obtain the new JWT from the Origin console under Endpoints → Connect
  2. Create a new jwt.txt containing the new token
  3. Edit the Deploy package — replace jwt.txt in Package Files and increment the version
  4. Existing registered agents are not affected — they maintain their own session credentials after initial registration. Only endpoints receiving a fresh install will use the updated JWT.

​
Removing the agent

A Resources/uninstall.sh script is bundled inside the app:
Add a Remove operation to the Deploy package using this command and deploy to the target computer group.

​
Mac Device Enrollment deprecation

Tanium Mac Device Enrollment is deprecated as of December 2025 and sunsets September 2026. If your environment currently uses Mac Device Enrollment, migrate to Tanium Device Management before implementing this guide. See the Tanium Endpoint Management for Mobile User Guide for migration steps.